Vulnerability

Vulnerability Classes

Deep dives into specific vulnerability types, with CWE references and prevention guidance.

21 articles in this category

VulnerabilityCWE-79A03:2021

Cross-Site Scripting (XSS): How It Works and How to Prevent It

Cross-site scripting remains one of the most prevalent web vulnerabilities, allowing attackers to inject malicious scripts into trusted websites and compromise user sessions, steal credentials, and deface applications.

9 min readRead article

VulnerabilityCWE-639A01:2021

Insecure Direct Object References: The Most Common Access Control Flaw

Insecure direct object references occur when an application exposes internal object identifiers without verifying that the requesting user is authorized to access them, enabling attackers to access or modify other users' data by simply changing a parameter.

9 min readRead article

VulnerabilityCWE-918A10:2021

Server-Side Request Forgery (SSRF): When Your Server Becomes the Attacker

Server-side request forgery turns your own infrastructure against you, allowing attackers to make your server send requests to internal systems, cloud metadata endpoints, and protected networks that should never be accessible from the outside.

10 min readRead article

VulnerabilityCWE-644

Host Header Injection: How Trusted Headers Become Attack Vectors

Host header injection exploits applications that trust the HTTP Host header for critical operations like password reset links, cache keys, and redirects — allowing attackers to poison caches, steal reset tokens, and redirect users to malicious sites.

9 min readRead article

VulnerabilityCWE-706A01:2021

Path Normalization Attacks: When a Slash Breaks Authentication

Path normalization attacks exploit inconsistencies in how different components of a web stack interpret URL paths, allowing attackers to bypass authentication middleware, access control rules, and WAF protections with techniques as simple as adding a trailing slash.

10 min readRead article

VulnerabilityCWE-284A01:2021

Broken Access Control: OWASP's #1 Web Application Vulnerability

Broken access control is the most prevalent web application vulnerability class. It lets attackers bypass authorization to view, modify, or delete resources they should never reach. Here's how it works, why scanners miss it, and how to fix it.

10 min readRead article

VulnerabilityA04:2021

Business Logic Vulnerabilities: What Scanners Can't Find

Business logic vulnerabilities exploit the intended functionality of an application in unintended ways. They don't trigger signatures, don't match patterns, and don't show up in automated scans. Finding them requires understanding how the application is supposed to work — and then breaking that assumption.

11 min readRead article

VulnerabilityCWE-352A01:2021

Cross-Site Request Forgery: Forcing Actions on Behalf of Authenticated Users

Cross-site request forgery exploits the browser's automatic inclusion of credentials to trick authenticated users into performing unintended actions. By forging requests that ride on existing sessions, attackers can change passwords, transfer funds, and modify account settings without the user's knowledge.

10 min readRead article

VulnerabilityCWE-345A02:2021

JWT Security: When Tokens Become Attack Vectors

JSON Web Tokens are the dominant authentication mechanism for modern APIs, but implementation flaws turn them into attack vectors. Algorithm confusion, weak secrets, and missing validation allow attackers to forge tokens, escalate privileges, and bypass authentication entirely.

10 min readRead article

VulnerabilityCWE-601A01:2021

Open Redirects: The Underestimated Phishing Amplifier

Open redirect vulnerabilities let attackers hijack trusted domains to route users to malicious destinations. Often dismissed as low-severity, they become critical when chained with OAuth flows, SSO implementations, and server-side request forgery.

9 min readRead article

VulnerabilityCWE-367A04:2021

Race Conditions in Web Applications: Exploiting Time-of-Check to Time-of-Use

Race conditions exploit the gap between when an application checks a constraint and when it enforces it. By sending parallel requests that arrive within this window, attackers can bypass rate limits, redeem coupons multiple times, and manipulate account balances — all without touching the application's logic directly.

10 min readRead article

VulnerabilityCWE-200A01:2021

GraphQL Security: Introspection, Batching, and Authorization Pitfalls

GraphQL APIs expose powerful capabilities by default — full schema introspection, query batching, and deeply nested queries. When authorization is implemented at the wrong layer or introspection is left enabled in production, attackers gain a complete blueprint of your API and the tools to exploit it.

10 min readRead article

VulnerabilityCWE-284A05:2021

Subdomain Takeover: When Dangling DNS Records Become Attack Surface

Subdomain takeover occurs when a DNS record points to a deprovisioned external service, allowing an attacker to claim that service and serve arbitrary content under a trusted domain. The result is phishing, cookie theft, and content security policy bypass — all from a legitimate-looking subdomain.

10 min readRead article

VulnerabilityCWE-1336A03:2021

Server-Side Template Injection: From Template Engines to Code Execution

Server-side template injection occurs when user-controlled input is concatenated directly into a template string rather than passed as a variable. The template engine evaluates the injected syntax as code, turning a text formatting feature into a remote code execution primitive.

11 min readRead article

VulnerabilityCWE-611A05:2021

XXE: XML External Entity Injection Explained

XML External Entity (XXE) injection exploits the way XML parsers resolve external references embedded in document markup. An attacker who can supply XML to a vulnerable endpoint can read arbitrary files from the server, perform server-side request forgery, and in specific configurations achieve remote code execution — all through a feature that exists in the XML specification itself.

9 min readRead article

VulnerabilityCWE-915A08:2021

Mass Assignment: How Auto-Binding Overwrites Protected Fields

Mass assignment vulnerabilities occur when web frameworks automatically bind HTTP request parameters to object properties without filtering which fields users are allowed to modify. A single extra key in a JSON body can silently overwrite a role, credit balance, or administrative flag — with no error and no warning.

8 min readRead article

VulnerabilityCWE-502A08:2021

Insecure Deserialization: Remote Code Execution Through Object Manipulation

Insecure deserialization occurs when an application reconstructs objects from untrusted serialized data without validating what is being instantiated. In languages like Java and PHP, the deserialization process itself triggers method execution — no secondary injection step required — making this one of the few vulnerability classes where parsing user input is enough to achieve remote code execution.

10 min readRead article

VulnerabilityCWE-863A01:2021

OAuth 2.0 Security: Common Implementation Flaws and How to Exploit Them

OAuth 2.0 is a widely implemented authorization framework, but its flexibility creates a large surface for implementation mistakes. Missing state parameter validation, unrestricted redirect URIs, leaking authorization codes through Referer headers, and improper token storage each represent exploitable pathways that bypass the security the protocol was designed to provide.

11 min readRead article

VulnerabilityCWE-770A04:2021

API Rate Limiting Bypass: When Throttling Fails

Rate limiting is the primary defense against credential stuffing, enumeration attacks, and resource exhaustion on API endpoints. When rate limiting is implemented incorrectly, these controls can be bypassed through header manipulation, endpoint variation, parameter cycling, and distributed request patterns — exposing applications to the attacks the throttling was meant to prevent.

11 min readRead article

VulnerabilityCWE-540A05:2021

Source Map Exposure: Leaking Your Entire Frontend Codebase

Source maps are build artifacts that reconstruct the original source code from minified or transpiled JavaScript bundles. When deployed to production servers without restriction, they hand any visitor the unobfuscated application logic, internal API routes, commented credentials, and architectural details that the minification process was never meant to protect.

9 min readRead article

VulnerabilityCWE-1385A01:2021

WebSocket Security: Hijacking, Injection, and Cross-Site Attacks

WebSocket connections upgrade from HTTP and inherit none of HTTP's same-origin protections. Without explicit origin validation, any website can initiate a WebSocket connection to any server that accepts the protocol upgrade — and that server will receive the connection carrying the victim's cookies. This is the foundation for cross-site WebSocket hijacking, one of several attack classes specific to persistent bidirectional connections.

10 min readRead article

Back to Knowledge Base